From 8fa4192cc66a8372e6d099e9af9138acf72504a2 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 28 Jul 2026 16:44:52 +1000 Subject: [PATCH 1/3] Add NetBox OAuth2/OIDC provider + application NetBox is being deployed to k8s (argocd-apps) with Authentik SSO via python-social-auth's OpenIdConnectAuth backend. Add the confidential OAuth2 provider/application (client_id netbox, openid/email/profile scopes, strict redirect to /oauth/complete/oidc/); the client_secret is read from Vault at kubernetes/namespace/netbox/default/oauth-credentials (the terraform-authentik runner policy already covers namespace/+/default/oauth-credentials). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- config/providers_oauth2/netbox.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 config/providers_oauth2/netbox.yaml diff --git a/config/providers_oauth2/netbox.yaml b/config/providers_oauth2/netbox.yaml new file mode 100644 index 0000000..7a4bba0 --- /dev/null +++ b/config/providers_oauth2/netbox.yaml @@ -0,0 +1,19 @@ +# OAuth2/OIDC provider + application for NetBox +# (netbox.k8s.syd1.au.unkin.net). client_secret is read from Vault, not committed. +# NetBox uses python-social-auth's OpenIdConnectAuth backend; its completion URL +# is /oauth/complete/oidc/. +name: NetBox +authorization_flow: default-provider-authorization-implicit-consent +invalidation_flow: default-provider-invalidation-flow +client_type: confidential +client_id: netbox +client_secret_vault: + mount: kv + path: kubernetes/namespace/netbox/default/oauth-credentials +scope_mappings: + - goauthentik.io/providers/oauth2/scope-openid + - goauthentik.io/providers/oauth2/scope-email + - goauthentik.io/providers/oauth2/scope-profile +redirect_uris: + - matching_mode: strict + url: https://netbox.k8s.syd1.au.unkin.net/oauth/complete/oidc/ -- 2.47.3 From 7d0b8416a7b6b7190af6a82b0396b57d2947a385 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 28 Jul 2026 16:49:42 +1000 Subject: [PATCH 2/3] Re-trigger CI after seeding netbox oauth-credentials in Vault The plan step reads the netbox client_secret from Vault at plan time; it now exists at kv/kubernetes/namespace/netbox/default/oauth-credentials. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv -- 2.47.3 From e8d0457f00eb3e678c51f54fbc40a87426ba19b3 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 28 Jul 2026 17:48:03 +1000 Subject: [PATCH 3/3] ci: re-run after authentik api recovery The plan step failed on transient authentik API 500s while refreshing unrelated existing applications; the API is healthy again (200). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv -- 2.47.3